Incident Management Process Research Articles

Modeling incident management processes in information security at an enterprise

Objectives. The primary aim of the study is to develop a model for managing information security incidents within an enterprise that minimizes damage and costs associated with incident resolution under limited resources and time constraints.Methods. The paper analyzes existing approaches to managing information security incidents, including mathematical and simulation models, stochastic differential equations, Markov chains, and other methods. The study is based on a systems approach, incorporating analysis of incident parameters, actions for their resolution, response times, damages due to incident occurrence, and the probability of incident elimination. To validate the developed model, synthetic data reflecting various types of incidents and possible actions were used.Results. The proposed model optimizes incident management by minimizing damage and costs. It considers parameters such as incident criticality, available resources, response time, and the likelihood of successful incident resolution. Testing of the model on synthetic data showed that the proposed approach significantly improves the selection of optimal actions for responding to incidents in situations constrained by budget and time limitations, thereby enhancing the overall effectiveness of incident management.Conclusions. Implementing the proposed model in enterprises will improve the overall level of information security, enhance incident response efficiency, and strengthen information protection processes. This will ensure the minimization of risks associated with data leaks and other incidents, thus helping enterprises to make informed and timely decisions under conditions of limited resources and time.

A compliance assessment system for Incident Management process

The Incident Management (IM) process is one of the core activities for increasing the overall security level of organizations and better responding to cyber attacks. Different security frameworks (such as ITIL and ISO 27035) provide guidelines for designing and properly implementing an effective IM process. Currently, assessing the compliance of the actual process implemented by an organization with such frameworks is a complex task. The assessment is mainly manually performed and requires much effort in the analysis and evaluation. In this paper, we first propose a taxonomy of compliance deviations to classify and prioritize the impacts of non-compliant causes. We combine trace alignment techniques with a new proposed cost model for the analysis of process deviations rather than process traces to prioritize interventions. We put these contributions into use in a system that automatically assesses the IM process compliance with a reference process model (e.g., the one described in the chosen security framework). It supports the auditor with increased awareness of process issues to make more focused decisions and improve the process’s effectiveness. We propose a benchmark validation for the model, and we show the system’s capability through a usage scenario based on a publicly available dataset of a real IM log. The source code of all components, including the code used for benchmarking, is publicly available as open source on GitHub.

Improving Incident Management Processes with Feature Models

A cybersecurity incident is any event that directly or indirectly affects the confidentiality, availability, or integrity of a system or a service (or its data). The aim of a cyber-incident management process is to restore normal service levels as quickly as possible, by mitigating or eliminating the effects of system service disruptions. During the different phases of a cyber-incident management process, the documentation can be confusing and difficult to comprehend, making it ineffective. This paper aims to improve cyber-incident management processes that already exist by introducing feature models in order to handle incident documentation, classification, prioritisation, and mitigation. An example of an improved cyber-incident process is evaluated with respect to its efficiency and effectiveness, by conducting two case studies. The results of this work reveal that the improved process increases efficiency in addressing and repairing cyber-incidents by reducing the incident response time.

Preparation of high-performance large-area perovskite solar cells by atomic layer deposition of metal oxide buffer layer

Perovskite solar cells have been widely recognized as the most promising new-type photovoltaic device due to its power conversion efficiency rapidly increasing from 3.8% to over 26% in merely fifteen years. However, the high performances are achieved mainly on small area cells with an active area lower than 0.1 cm<sup>2</sup>. When enlarging the active area of perovskite solar cells, the efficiency falls dramatically. So, how to reduce the gap between performances of small area cells and large area cells gradually becomes a critical point in the path towards the commercialization of perovskite photovoltaic technology. Herein, a strategy of pre-growing thin layer of TiO<sub>2</sub> on a rough FTO substrate by atomic layer deposition method before spin-coating SnO<sub>2</sub> nanoparticles is proposed. Due to the inherent conformal film growth mode of atomic layer deposition, the FTO substrate can be completely covered by TiO<sub>2</sub>, thus preventing the direct contact between local protrusions of FTO and perovskite layer and impeding the current leakage phenomenon, which can be verified by the measurements from X-ray photoelectron spectroscopy, scanning electron microscopy, and atomic force microscopy, and further proved by the dark current measurement. By using this method, the repeatability and consistency of the small area cell fabrication technology on the same substrate are improved obviously. The improved electron transport process revealed by photoluminescence results and incident light management process revealed by external quantum efficiency results also brings about better solar cell performances. More importantly, highly efficient 0.5 cm<sup>2</sup> large area perovskite solar cells are fabricated through optimization of TiO<sub>2</sub> thickness. When growing 200 cycles TiO<sub>2</sub> (~9 nm in thickness) by using atomic layer deposition technology, the champion large area perovskite solar cell possesses a power conversion efficiency as high as 24.8% (certified 24.65%). The device performances also show excellent repeatability between different fabrication batches. The perovskite solar cell with TiO<sub>2</sub> buffer layer grown by the atomic layer deposition method can still retain over 95% of its initial efficiency after having been stored in a nitrogen atmosphere for 1500 h. The technique proposed in this paper can be helpful in manufacturing perovskite solar cell modules in the realistic photovoltaic market and can be extended to the large area fabrication of other perovskite optoelectronic devices such as light emitting diode, laser and detector.

Bridging the Gap: Enhancing Maritime Vessel Cyber Resilience through Security Operation Centers.

Increasingly disruptive cyber-attacks in the maritime domain have led to more efforts being focused on enhancing cyber resilience. From a regulatory perspective, there is a requirement that maritime stakeholders implement measures that would enable the timely detection of cyber events, leading to the adoption of Maritime Security Operation Centers (M-SOCs). At the same time, Remote Operation Centers (ROCs) are also being discussed to enable increased adoption of highly automated and autonomous technologies, which could further impact the attack surface of vessels. The main objective of this research was therefore to better understand both enabling factors and challenges impacting the effectiveness of M-SOC operations. Semi-structured interviews were conducted with nine M-SOC experts. Informed by grounded theory, incident management emerged as the core category. By focusing on the factors that make M-SOC operations a unique undertaking, the main contribution of this study is that it highlights how maritime connectivity challenges and domain knowledge impact the M-SOC incident management process. Additionally, we have related the findings to a future where M-SOC and ROC operations could be converged.

Enhancing ITIL Incident Management: Innovative Machine Learning Approaches for Efficient Incident Prioritization and Resolution

Incident Management in ITIL requires an effective process so the incidents do not disrupt business processes for too long. This research aims to automate decision-making in Incident Management process. To perform the automation in decision-making process requires machine learning algorithms. The development of machine learning method in this research will bring significance result such as a new technique of decision-making process in Incident Management, accelerate decision-making process in Incident Management by implementing machine learning to determine the category, group, and priority. By combining supervised and unsupervised machine learning, this research can help to determine the priority of the incident, so IT Operation Teams know which incident should resolve first. By training historical full description, short description, and title, machine learning can classify the new incident. In this research different classification algorithms are used to automate decision making process. Performances of automated decision-making are evaluated with accuracy, precision, recall, and f1-score. Based on the result of various performance metrics, classifier based on K-Nearest Neighbor performed well on predicting Priority, and both category and priority get the best performance with Support Vector Machine.

Evaluasi Kinerja Web Haji dan Umrah NSK Group Pekanbaru Perspektif Pengguna Menggunakan Framework Cobit 2019

This research is grounded in the importance of websites in providing services for Hajj and Umrah pilgrimages, reflecting the role of technological advancement in delivering information and facilities to pilgrims. The primary aim of this study is to understand the role of websites in facilitating Hajj and Umrah services and to evaluate their effectiveness in enhancing the experiences and satisfaction of pilgrims. A qualitative descriptive methodology was employed, gathering data through direct observation and questionnaires, supplemented by an analysis of relevant literature. The findings indicate that effective and user-friendly websites enhance pilgrim experiences and simplify the processes of booking, accommodation, and transportation. An analysis using the COBIT 2019 framework underscores the significance of IT management in improving website performance. The implications of this study highlight the need for continuous innovation and improvement in data security, incident management, and business process efficiency of websites to increase customer satisfaction and ensure the efficient and secure provision of Hajj and Umrah services.

The art of the possible? Supporting a patient safety culture in mental healthcare to maximise safety

PurposeThe current national patient safety strategy for the National Health Service (NHS) in England states that actions need to be taken to support the development of a patient safety culture. This includes that local systems should seek to understand staff perceptions of the fairness and effectiveness of serious incident management. This study aims to explore the perspectives of patient safety professionals about what works well and what could be done better to support a patient safety culture at the level of Trust strategy and serious incident governance.Design/methodology/approachA total of 15 professionals with a role in serious incident management, from five mental health trusts in England, were interviewed using a semi-structured interview guide. Thematic analysis and qualitative description were used to analyse the data.FindingsParticipants felt that actions to support a patient safety culture were challenging and required long-term and clinical commitment. Broadening the scope of serious incident investigations was felt to be one way to better understand patient safety culture issues. Organisational influences during the serious incident management process were highlighted, informing approaches to maximise the fairness and objectivity of investigation findings.Originality/valueThe findings of this study offer original insights that the NHS safety system can use to facilitate progression of the patient safety culture agenda. In particular, local mental health trusts could consider the findings in the context of their current strategic objectives related to patient safety culture and operational delivery of serious incident management frameworks.

Enterprise data and semantic modelling: conceptual model of information technology incident management

Knowledge management methods and their efficient implementation across the organization determine sound and resilient management of processes. This paper studies the semantic integration of enterprise data sources essential to service management processes. Implementing a semantic layer within the enterprise architecture uses various tools, methods, and techniques. The semantic conceptual model unifies and implements intelligent integration of multiple data sources across the enterprise, achieving consistency and more accessible interpretation. Specifically, we draw our attention to incident and problem management within enterprises. We propose an ontology - a conceptual model for the incident management process. The incident ontology presented as an intelligent data integration layer component aims to achieve operational excellence. Besides, this ontology is a fundamental part of the proactive process in problem management. An ontology as a logic-based system supports integrity validation. It infers new, no explicitly modeled facts in the problem domain, thus helping experts better analyze and understand the problem. We discuss the conducted experiment results with the proposed in this article conceptual model using the enterprise knowledge graph platform. It can be perceived as a framework for a query-answering system with components, including ontology schema, data mapping, and classification methods for data graph enrichment.

Methods of Identifying Vulnerabilities in the Information Security Incident Management Process

"The application of tools and methods to improve the effectiveness of the information security management system by detecting and neutralizing cyber attacks, monitoring and blocking DDoS attacks, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), blocking TOR Exit Nodes, blocking Layer 7 Regular Expression attacks, web filtering, blocking malware attacks, ransomware, spammers and spam servers has become a sine-qua-non requirement in the management of information security incidents in order to minimize their impact on IT systems. The paper provides insight into the impact of integrating much-needed security requirements for information technology users in military systems. The collection of information was carried out on a statistical sample of 128 students from military academies in Romania, Bulgaria, Poland. The research methods are complemented by cross-sectional (questionnaire, survey, observation) and observational methods."

DATA WAREHOUSE MODEL BASED ON KIMBALL METHODOLOGY TO SUPPORT DECISION MAKING IN ASSET MAINTENANCE

ITSM e-Prime is an ICT service management application based on ITSM framework owned by Pusintek that includes service desk, incident management, problem management, change management, release management, and configuration management processes. Currently there is a problem in determining the number of devices that will be included in the device maintenance contract or determining the number of devices that need to be replaced in a given year. The objective of this research is to build an asset management data warehouse so that it can be utilized by the Data Analysis and Presentation Team to produce a dashboard that presents data on network infrastructure assets that need to be maintained or replaced for budget planning needs. This descriptive verification analysis research used nine out of ninety tables from the ITSM e-Prime application and applied dimensional modeling Kimball to build a data warehouse because this methodology offers high query performance and understandable by end-user. The resulting data warehouse were tables in the form of star-schema. The tests were carried out by qualitative methods, namely quality testing by users (user acceptance test and blackbox testing) and quantitative method, namely comparing the number of infrastructure devices included in the maintenance contract in 2022. The final result of this research is a data warehouse consisting of fact table F_infrastructure and dimension table D_Merk, D_Area, D_Kategori, D_EoS, D_Garansi, and D_StatusPemeliharaan with acceptance percentage of 95% based on the test results.

How effectively has a Just Culture been adopted? A qualitative study to analyse the attitudes and behaviours of clinicians and managers to clinical incident management within an NHS Hospital Trust and identify enablers and barriers to achieving a Just Culture

ObjectivesJust Culture aims to improve patient safety by examining the organisational and individual factors that contribute to adverse events, enabling corrective action so that errors are not repeated. This qualitative...

PENYUSUNAN SOP MANAJEMEN INSIDEN KEHILANGAN ATAU PENCURIAN DATA PADA DSDABM KOTA BANDUNG MENGGUNAKAN FRAMEWORK ITIL V3

With the development of Information Technology at the Bandung City DSDABM, it has an impact on the high user needs, both the use of devices, IT services and the need for data and information security. With the existence of vulnerabilities and threats to both IT equipment and data and information, there is a need for incident management in dealing with any IT problems or as a function of IT services to users so that business processes can continue to run. This study will describe the incident management process flow, incident category, service strategy and incident escalation flow based on the proposed ITIL V3 Framework. The result of this research is the preparation of incident management SOP documents that are clearer and more structured both to users and to IT managers in carrying out IT equipment maintenance, service and handling of each incident. Keywords: Information Technology, Security, Data and Information, Incident Management, ITIL V3

Analysis Of Information Technology Services Management Using ITIL V3 Domain Service Operation (Case Study: Hotel Sinar Sidoarjo)

Information system is one of the most rapid developments of information technology in its development. This information system itself aims to help human work to be more efficient and effective. The quality of technology has many aspects that must be measured to evaluate in order to continue to develop. Service is an important aspect that needs to be improved in order to support the applied Information Technology. ITIL as a framework that focuses on the assessment of information technology services was chosen as the method to be applied in this research. The problem that often occurs in this Sinar Hotel is the existence of obstacles in customer data in the Front Office department. Customer data is often not inputted into the system so that customers have to re-enter data and this is time consuming and less efficient. The incoming data also sometimes does not match the customer's personal data which also results in the customer needing to re-enter the data. The Service Operation domain was chosen to assess the extent to which the problem management and incident management processes were implemented properly. The results of this study will produce a recommendation to overcome problems and incidents that often occur in order to facilitate the operational activities of Hotel Sinar.

Explainable AI for Security of Human-Interactive Robots

This article considers the ways that explainable AI can be used to help secure human-interactive robots. To do so, we acknowledge that robots interact with a variety of people. For example, some people may operate robots that perform tasks in their homes or offices, while other people may be tasked with defending robots from potential attackers. We describe how explainable AI can be used to help the human operators of robots appropriately calibrate the trust they have in their systems, and we demonstrate this through an implementation. We also describe a novel generalizable human-in-the-loop framework based on control loops to characterize and explain attacks on robots to a robot defender. We explore the utility of such a framework through an analysis of its application in the incident management process, applied to robots. This framework allows formal definition of explainability, and the necessary condition for explainability in robots. The overarching goal of this article is to introduce the application of explainability for security of robotics as a novel area of research, therefore, we also discuss several open research problems we uncovered while applying explainable AI to security of robots.

ITIL v3 Framework Application to Design Information Technology Incident Management Governance

Information technology (IT) is one of the strategic investments for Banks. IT can increase the efficiency and effectiveness of operational activities and strengthen their competitive position. Given that IT is an expensive investment, while its implementation contains various risks, Banks need to implement Information Technology Governance. Banks are required to implement some standards for IT governance in multiple aspects, one of which is the IT incident management aspect. IT services at the Bank are crucial because they must work optimally with zero downtime. They must ensure the management and prevention of any problems that may arise to support the sustainability of the company’s business processes. One of the frameworks that can be used for good IT service incident management is Information Technology Infrastructure Library version 3 (ITIL v3). ITIL’s incident management aims to restore disrupted IT services to their normal state and reduce the business impact. To measure the extent to which the Bank has implemented IT Incident Management Governance, the maturity level is calculated by comparing the current state (as is) and the desired shape (to be) to obtain the maturity level gap. The process of maturity level assessment is carried out using interviews and questionnaires addressed to all stakeholders involved in the entire IT incident management process. The research results show that 15 of the 42 IT incident management processes have not reached the desired state. Based on these gaps, an IT incident management governance document was designed based on the ITIL v3 framework, which is expected when implemented in the Bank’s daily operations. It will increase the availability of IT services.

Improving IT Service Management in Customer Service Business: A Case Study

Organisations that provide information technology services mostly set goals for improving the quality and management of services. The ability to remain competitive is one of the most critical factors in any modern organisation's success. For business processes to be successful, it is necessary to rely on rational and well-thought-out solutions. In many cases, data-based solutions create conditions to avoid or reduce significant risks. The article examines the possibilities of applying IT processes to improve customer service and presents its improvement outcomes. Customer satisfaction with the services provided is directly correlated with the quality of services. The research investigates and empirically evaluates the existing IT incident management processes of the selected company and provides opportunities for their improvement. After analysing incident management processes in the selected company, an improvement of the incident management processes was presented to eliminate the identified deficiencies. Descriptive and inferential statistical methods were used to evaluate the effectiveness of the improvements. The results obtained show that the improved process had a statistically significant positive impact on improving the customer service quality. Therefore, it can be stated that the implemented changes are effective and useful in the context of the company's operations.

Key Factors in Achieving Service Level Agreements (SLA) for Information Technology (IT) Incident Resolution.

In this paper, we analyze the impact of various factors on meeting service level agreements (SLAs) for information technology (IT) incident resolution. Using a large IT services incident dataset, we develop and compare multiple models to predict the value of a target Boolean variable indicating whether an incident met its SLA. Logistic regression and neural network models are found to have the best performance in terms of misclassification rates and average squared error. From the best-performing models, we identify a set of key variables that influence the achievement of SLAs. Based on model insights, we provide a thorough discussion of IT process management implications. We suggest several strategies that can be adopted by incident management teams to improve the quality and effectiveness of incident management processes, and recommend avenues for future research.

Chatbot Based Solution for Supporting Software Incident Management Process

A set of steps for implementing a chatbot, to support decision-making activities in the software incident management process is proposed and discussed in this article. Each step is presented independently of the platform used for the construction of chatbots and are detailed with their respective activities. The proposed steps can be carried out in a continuous and adaptable way, favoring the constant training of a chatbot and allowing the increasingly cohesive interpretatin of the intentions of the specialists who work in the Software Incident Management Process. The software incident resolution process accordingly to the ITIL framework, is considered for the experiment. The results of the work present the steps for the chatbot construction, the solution based on DialogFlow platform and some conclusions based on the experiment.

Improving the Incident Management Process Based on a Use Case Approach

The purpose of the study is to improve the incident management process. The article considers the process approach to incident management in case of technical failures and its main stages: detection, response, investigation, elimination, resolution. At the stages of response and investigation of the incident, as well as its elimination, there is an urgent problem, which is the violation of the deadlines adopted in the Service Level Agreement (SLA). A comparative analysis of the indicators before and after the application of the proposed use case approach is carried out. The proposed algorithm, applying the base of use cases, allows reducing the number of incidents that are returned for revision, as well as reduce the number of incidents, the resolution period of which exceeds the limits accepted according to the SLA. The scientific novelty lies in the use of the case analysis device for incident processing in the technical support service. Materials and methods. To solve the above problem related to the violation of the deadlines for processing incidents accepted in the SLA, the article considers an approach to improving the incident management process based on the use case analysis of incidents. The use of the case analysis device is a cycle of reasoning based on use cases. By the value of the degree of similarity to the incident, a specific use case and the associated decision-making scenario are selected. The method of plausible reasoning allows us to solve the problem of multiple escalations as an integrated automation tool and, as a result, reduce the number of violations of the deadlines for resolving incidents. This approach allows you to increase the efficiency of finding similar scenarios for responding to incidents. The nearest neighbor method is used to compare and extract use cases. This method does not require large computational costs and provides the required degree of reliability (error) of the decision. The application of the nearest neighbor method is based on calculating the degree of proximity of the current situation to the use cases stored in the base of use cases. Results. The proposed approach allowed us to develop a new algorithm for classifying incidents in the information system based on the use case and statistical analysis, which reduces the response time and eliminates incidents. The analysis of statistical data is carried out; the efficiency is estimated as a result of the application of the algorithm based on the use case analysis. The assessment showed a significant reduction in unnecessary escalations of incidents to the second support line, so the application of the base of use cases in resolving incidents allowed for improving the incident management process. Conclusion. In the course of the study, the main problem in the incident management process was identified - violation of the deadlines adopted in the SLA. The basic incident management algorithm is analyzed. The application of the method of plausible reasoning and the nearest neighbor method is justified. The cycle of updating the base of use cases and the conceptual model of the incident management process are considered. Within the framework of the developed conceptual model, the base of use cases includes decisions made by experts, which use the knowledge of previous experience to get out of a particular situation. An algorithm for finding a solution in the base of use cases is implemented. A distinctive feature of the developed algorithm is the application of a use case recognition algorithm and the search for similar images contained in the base of use cases using the nearest neighbor method.